Windows users urged to install huge security update

Patch Tuesday fixes 26 bugs

For the second time in the last four months, Microsoft today shipped a record 13 security updates that patched dozens of vulnerabilities in Windows.

The 26 flaws fixed yesterday were off the record of 34 set in October 2009 when Microsoft last issued 13 security bulletins. However, if Microsoft had waited until yesterday to deliver the Internet Explorer (IE) update it released late last month - the IE patches were original scheduled to appear as part of yesterday's collection - this month's lot would have tied the vulnerability record.

Five of the 13 updates were marked 'critical', the highest threat ranking in Microsoft's four-step scoring system. Seven were ranked 'important', the next-lower rating, while one was pegged 'moderate'. Eleven of the 13 affected Windows, while the remaining pair impacted Office XP and Office 2003 on Windows and Office 2004 for Mac.

Three of the updates stood out immediately, said Andrew Storms, director of security operations at nCircle Network Security, including one related to DirectShow, a component of Windows' DirectX graphics infrastructure; and two involving SMB (Server Message Block), the Microsoft-made network file and print-sharing protocol.

"The DirectShow vulnerability in MS10-013 has the potential for a classic drive-by attack," said Storms, who noted that the flaw is in Windows' parsing of .avi movie files. "There's no shortage of people watching video on the web," Storms said, adding that he put the update on his short list because of the potential for large-scale attacks.

Microsoft agreed, tagging the update as critical and betting that attackers will come up with reliable exploits for the bug in the next 30 days.

Storms' other must-patch updates were a pair related to SMB: MS10-006 on the client side and MS10-012 on the server side.

Other than the historical nature of those updates - Microsoft quashed six bugs in SMB last year on two different Patch Tuesdays - Storms pointed out that Microsoft believes the flaws serious, more dangerous apparently than the SMB vulnerability it didn't fix yesterday, even though that bug has exploit code in circulation.

"Microsoft's saying that these patches are much more important, even though there is public code out there for the denial-of-service," Storms said, referring to the outstanding security advisory for an SMB flaw that it said last week it wouldn't fix yesterday. "Usually the big attack vector is on the server side [for SMB], since they're typically network-based attacks," he continued. "We haven't been too worried about them because of default firewalls, but this month we're seeing vulnerabilities on the client side as well."

Other updates patched PowerPoint, Office's presentation maker; Microsoft Paint, the bare bones paint program included with all versions of Windows; the operating system's implementation of TCP/IP; Windows Server 2008's Hyper-V virtualisation software; the Windows kernel; and other bits and pieces of Windows.

The kernel update, MS10-015 , patched the 17-year-old bug in all 32-bit versions of Windows that went public on January 19 when a Google engineer disclosed the vulnerability on a security mailing list.

As announced last week, Microsoft did not patch an IE bug it only recently confirmed.

This month's security update can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Share this article

X

Email this to a friend

Characters remaining: 337

What is A + B?

Comments

Sergio Gutierrez said: Lucky me I dont have any problemsI use Windows XP in one of my computers the one connected to the internet but I do not use any other Microsoft programMy office suite is Open Office free an superior to MS OfficeI use Mozilla a lot better and more secure than IEI do not use any email client I dont need them I retrieve my emails directly from my ISPs serverAs I said no problems

jtt said: Criticise User Account Control all you want but its there if you want it and you can turn it off if you dont like it Nobody forces you to use it

Cyteck said: YES were all quick too shoot Microsoft down in flames for software faults amp vulnerabilities but they do make an effort to fix them as quickly as they can OK sometimes thats not very quick you could argue but try to see it another way If MS made products which had faults amp vulnerabilities in them and they didnt fix them they would go bust VERY very quickly Plus MS has a legal obligation in law to supply end users amp business users with fixes for identified known problems ie patch security holes in their products Microsoft is NOT the only company to follow this model many other software companies to the same Providing free updates is a win win situation everyone benefits in the wider scheme of things

H Riddle said: I suppose this explains the endless stream of MS updates in the last few months Many seem to be a push towards W7 crude marketing Though we should be grateful that like Toyota they seem to have some concern for their customers

Smart home- or wearable tech: which is more likely to benefit your digital life this year?

I'm more likely to buy smart home- than wearable tech this yearI'm more likely to buy wearable- than smart home tech this yearI'll probably buy both smart home- and wearable tech this yearI'm unlikely to buy smart home- or wearable tech this yearNot sure/don't know